Privacy Policy

As Tolerance Seyahat Turizm ve Organizasyon Anonim Şirketi (“Lufer Tour”), we are committed to processing the information you share while using the tour reservation services we offer through lufer.com.tr in a confidential manner. This policy complements our KVKK Information Notice and explains our privacy practices specific to our services.

Data Controller / Seller: Tolerance Seyahat Turizm ve Organizasyon Anonim Şirketi (operating under the “Lufer Tour” brand)

Address: Orhan Veli Kanık Street No: 53/1 Kavacık / Beykoz / Istanbul

Tax Office/No: Beykoz Tax Office / 8490698779

MERSİS No: 0849069877900001

E-mail: bilgi@lufer.com.tr

Phone: +908504206464

Web: lufer.com.tr

1. Information We Collect

• Account information: name, surname, e-mail, phone, password (encrypted).
• Reservation information: selected tour, date/time, number of people, communication preference, billing information.
• Payment information: All card transactions are processed on the PCI-DSS certified Iyzico infrastructure. Lufer Tour does not store, see, or receive card number, CVV, or expiration date on its servers.
• Usage information: IP, browser, session log, page views.
• Cookies/analytics: GA4 and Meta Pixel only with consent.

2. How We Use the Information

• To establish the reservation, collect payment, confirm the tour, and send change notifications.
• Customer support, request, and complaint management.
• Security of your account and prevention of fraud.
• Fulfilling legal obligations (tax, manifest, commercial law).
• Subject to your consent; e-mail/SMS marketing, campaign notifications, site analysis via GA4/Meta Pixel.

3. Sharing with Third Parties

We share your data only with the following parties, and only to the extent necessary:

• Iyzico (payment & refund)
• Resend / Gmail SMTP (e-mail delivery)
• Google Ireland Ltd. (only with consent, GA4)
• Meta Platforms Ireland Ltd. (only with consent, Meta Pixel)
• Legal authorities (where required by law)

We do not sell or rent your data to advertising partners.

4. Security Measures

• All connections are encrypted with HTTPS / TLS.
• Passwords are stored hashed using modern algorithms such as bcrypt.
• Payment data is processed in the PCI-DSS compliant Iyzico infrastructure; card information is not stored on our servers.
• Role-based authorization is implemented against unauthorized access; admin panel logs are kept.

5. Children's Privacy

Our services are not intended for users under 18 to make reservations on their own. Information relating to children is provided only by the parent/guardian making the reservation and is used for manifest / age category determination.

6. Retention and Deletion

Your data is retained for the periods specified in Article 6 of the KVKK Information Notice. At the end of the period, it is deleted, destroyed, or anonymized.

7. Your Rights and Contact

To exercise your rights under Article 11 of the KVKK and for any privacy-related requests, you may contact bilgi@lufer.com.tr.